SB2026101562 - Anolis OS update for curl
Published: October 15, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 3 vulnerabilities.
1) Use-after-free (CVE-ID: CVE-2026-18924)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to trigger a use-after-free.
The vulnerability exists due to use-after-free in libcurl HTTP/2 server push stream handling when processing an HTTPS HTTP/2 server push on a shared connection. A remote attacker can send a server push response sequence to trigger a use-after-free.
The issue affects libcurl only and requires HTTP/2 server push to be enabled and accepted by the application, along with connection sharing.
2) Exposure of Data Element to Wrong Session (CVE-ID: CVE-2026-80231)
CWE-ID: CWE-488 - Exposure of Data Element to Wrong Session
CVSSv4: 2.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to bypass intended certificate validation settings.
The vulnerability exists due to exposure of data element to wrong session in HTTPS connection reuse logic when reusing an existing connection for the same hostname with a different native CA store setting. A remote user can cause a transfer to use a previously established HTTPS connection to bypass intended certificate validation settings.
This issue affects Windows and macOS and also impacts the curl command line tool.
3) Insertion of Sensitive Information Into Sent Data (CVE-ID: CVE-2026-82209)
CWE-ID: CWE-201 - Insertion of Sensitive Information Into Sent Data
CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to disclose sensitive information.
The vulnerability exists due to information exposure through sent data in the libcurl cookie handling logic when processing a Set-Cookie header with a Domain attribute matching an origin host that is itself a public suffix. A remote attacker can induce the client to send a previously stored cookie to an arbitrary sibling subdomain under the same public suffix to disclose sensitive information.
Exploitation requires libpsl support to be enabled, the apex public-suffix host to issue the cookie, and the client to subsequently contact an attacker-controlled sibling subdomain.
Remediation
Install update from vendor's website.